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(54)TitIe: ACTIVE MESSAGING SYSTEM 




(57) Abstract . , . ■ 'i - ^. ^ ; ^;;* .* ■ . . 

A computer systenT(l 2) for receiving active messages comprises a central processing unit (21) and r^ripheral devices .(24, 
25, 26, 27, 28) connected to the central processing unit, such as a file memory system (24, 25) for storing a file system of 'a reci- 
pient of the active message. The .computer system includes an interpreter (70) for interpreting instructions contained in an] active 
message to convert the instructions into machine instructions to be executed by said central processing unit. To prevent an active 
message from causing a deprivation of resources, the iristnictiori sef which is interpreted by the interpreter is limited. The interpre- 
ter interprets a subset pfJnstructions of a general purpose computer language which does not relate to the mputtirig and output- 
ting of data to and from [peripheral deWqes/The interpreter "iifiterprets'arset of input/output instructors which can only achieve 
limited access to the file system and which controls the amount of data which is transmitted to and from peripheral devices- 
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ACTIVE MESSAGING 



Field of the Tnvention 

Conventional electronic mail is in the form of a 
passive textual message that is created by an originator, 
transmitted to a recipient and read by the recipient. Any 
further actions must be initiated by the recipient. In 
contrast, an active message is a program which is created 
by an originator, transmitted to a' recipient, and executed 
in the recipient's computer environment. The present 
invention relates to an active messaging system and method 
which enables a recipient to enjoy the benefits of active 
messaging while reducing the security threats posed by 
15 active massaging. 

Background of the Invention 

: .In /the growing field of office systems, no system is 
considered complete unless it has an electronic mail 
facility, Currcuitly available electronic mail systems 
20 allow passive sent to othei^ 
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users on the system or hetwbrk.- A passive message, i.e., a 
piece of text conveying some information, is created by a 
sender and shipped k by^ 

recipients. A passive 'm&ss&ge :-"caii only cbnvey information, 
5 it «mnot collect ^fbrm 
message is comply 

In con^ast t^^a is 

recipient V asking questions iand collecting answers. The 
10 sender' does' 'hot nefed to depend : upon the recipient creating 
' another ^ passive' liessa^e^ £ii" response to 1 some. question , as 
this may i>e dime by the ' ^active^ iessagie itself. 
Convehtiohai eXe 

origihal ( sehdear spi&if ies a iikt of 7 xebipiehts and the 
15 message"!^ s«i^ 

In contrast , b^causia ah 1 acfci ve ^ messkge^ is a program , in the 

• ■ . • ■■ • 

bourse of ' b4in£ ruh ^oti i^eri& ; *$£*^& : fecipieht; lithe s active 
messageTln^^ - 

Active messaging^ benef its to 

20 users. One important use of activfe-m^^agiSig^ Is to' 

implement a "'cotbsA messages 
W potential H e^ to' questions* If 

one potential expert l d6esi hot i&oW W^^V^ Active 
message will to ' £li&tt ther idehtities of additional 

25 potential exp^w^ Md' : c^ 

these additionai 1 pot:ehtiai expert^ v ' ^eh : an ^bcpert who 
knows the answerT is f ou^ the 
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-■- answer to be ..transmitted original sender of the 

■*■ question. ../.•,i,-.-:,^ f ,i - : , * • 

active messaging is to 
. automate the japst ( routine, and araoyin^ aspects of 
5 : scheduling meetings or r otte^,p^rrent events.. Currently, ... 
meetings -are. scheduled ; as a i;esu^t ; of an extensive exchange 
of pa^ive, messages^ e.g. ^ o y^ ? n TujMday at 3 :00 

r iPffi'! '■Wue'SdaySi ;rare bad for me, &pt? about Wednesday 
morning?*? ^WetoiBfsday morning is no good., how about the 
10 afternoon?.?. Such exchanges can be automated using active 
messaging. For example^ an: ^ctiye. pessage can make the 
rounds of all t^e to attend a 

meeting.; : From each one,, the Active message collects one or 
- more plausiW The active 

15 message: then-sends a copy jo£, .itself, augmented with the 
colleqte^da^ Eventually, 
^ VP9 s sibly rafter sweral 4t^ratipM ^e T actiye message will 
find a date ajid time.yhen all r : the,, participants can meet. 
The* active message will ? vthen, infprm all the participants of 
20 tlus date^^ ..^ 

. .,: Aclbiye messagi^ v[ay ^J?p, J}e r ptilized^ for paperwork 
automation- ^ 
. routine processes that sure handled by massive amounts of * r 
,p^j^^ork ? v Aj si|priificant pp^i^ri. of , sucht^ paperwork has tg^ 
25 * . b^jrouted throiigh s^ver^il organizational centers in 

sequence for approvals,, or pth©r kinds of, intermediate 
actiqns^^, psi^ much of this proceaaing 
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one organizational center fbr^askirig * f ^ukstibns to 
collect certain information. The active mekfeage- tnen sends 
itself off tb the heict iink^iif ^^rgaiii^fbnal chain. 
.5 'For examplef' eyerie vouchers," ^ WdersV and'' 
" insurance ciaiis can" be^ prbcessea iii th^'^-"'" 
u ' y - r ' "• A^tili"fur^ 5 application of 'acti^S ^a-gin^ ; ls the 

' "%oiiect^o^ ' 

While 'ac^ messaging has kany^ benefits, it 

10 i^iiso -evident 'that if r active ! mes^^ ate' written 

' 0: "' i£V suffibieniiy'p^ enormous harm'can 

' r 'xesultr^Por'eWamp^/'s^ ^ send a message which 
^^"airttl'-'fiSrof ^e"recbi^''EVen tore 

- ^sidi^^^ 
15 ' br ^^c^ 

' ? : ^%o ^ie^of a ■ 
recipient: Other dangers posed by active messaging include 
the" deprlva^i of : rile' «soi£ces^ 'tf by^^&i*>3 ' " , ■ . 
• " listing ; files ; ^r W filling ^ "itff i iiT s^e* of ^ 
.20" ^^i&nt 'with' ^aV'the ^BpriVation o'f ^ tiine by 

' ^ transmit^g« : Si^ i long ti^e to : 

■ " and de£ivat£in of i/0 ^esou^ces *uch^s a 

25 . sul ^S overw^ ' 
" ' ^ ''^for'ac^ ^ use^u^ reality / a system 



WOW/22033 - PCT/US92/00935 



v . - 5 • 

ipust.be 4ey^s^d wherein the utilization of active messages 
c^^Qt .^sult in .unacceptable dan to the active message 
recipients* 

: - b .^^f 7® m ^ s , a ?ip? systems ha Y e previously 

been, proposed, , , However, t ...nog?, of the prior systems have 
?atisfa^^rU problems resulting 

from.afetiye messaging. One aptive messaging system known m 
as "R2D2? .feas,. no provisions for security (see, e.g. , John * 
Vitt^jL, "Active Message Processing: Messages As 
IMessengers", in Computer Message Systems, R.P. Uhlig, 
editpr^ Nprt^-pplland Publishing Company, 1981). Another 
:^^%^ 6 f9^.^f^mk 4s. toown as^"imail^ (see,_ e.g, John 
Ho 99 f ,^to T Artiye Mail ^stem? , ... Proceedings of SIGMOO 
'?4, Bpsst^n 1984:) . The "imail" system gains security from 
ratt^^qrucial restriction. Active messages can only be 
exchanged among .users of a single machine using specialized 
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15 , . ; ,a 



software. 



Specialized active messaging functionality, i.e./ a 

^^t^ 1 ;,syst«n . that , ia^lements one or a few special cases of / V 
£ c tiye messaging, sqch as return-receipt mail, requests for: 
y?^ e Sf_,and other specific types of active messages have 
al ?o .^^n developed. One example of such a specialized 
a ^iy? JP€tssaging system is the "Andrew" system (see e.g. , H 



25 



^^^einr ,f»t al, "Architectural Issues in toe Andrew 

- !...,^... V w;;,'r. /l , ( -^p^'.j^^d^oc 1 ::^/: io^^^ - 

Message Systems"; E. Stefferud et al, "Message Handling 

Distribixted Applications" ; iahd Borensteih et 
a Jk' wp< ?w?^ Ease of Use and Cooperative Work in a Practical 
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Multimedia Message System' 1 , Int. J; Man-Machine Studies 
(1991) 34, pp. 229-259)* .•'" :: *hi$*type ; 6"f 'system -'avoids 
problems in security "by defining ;;: 'a ^very" specialized syntax 
for a singie ki^d'of ^ 
5 Therefore the"6apabiiity 'of "doing great: harm, such-as by 
deleting all of the recipient '* ' f ileS -or creating a 
virus, is not present in such systems. A more general 
system based 'on "toe* spec^^ ' 
"Ness" (seee.g: / W. fxed Hansen; ^Enhancin^ Documents With 
10 'iiJ^AA^A ^ograns; How Ness' Extends Insets ih^the^Ahdrew 
' Took KitrT i^ce'ealn^' of ■ IEEE Computer Society; 199.0, 

Interna^onai • coniere^ic^ "in I Xo^puter Xariguage; 1 New Orleans , 
' 199 0) . ' " 1 ''«N(^s "' ~is . iproba^jl^ ~tne ' : 'mos€"* v pbwerf ul of /the J prior 
' • ^a^actiro me^ 
15 solution to '^th&^i&xri^ ^dbiem*.' - ! When ^ : recipient reads a 
• ' message with ' a Hes^ "progra^ : iM^ asked • 

if he/she trusts ''the ■ 'author' of th^ program and ^is given the 
" : ^po£tuni*y to 'read ihe ; "c^"ber*or¥"execut;ihg -Ness 
• programs have ^ the-' cApah^ as 
20 " '''delating the Wcipieiit:'' :: f1iies : '. ' :: Thus' £f '^"xecipient •■wrongly 
iiidic*ibis. : tr^ "^-••' : '-* 
" £inaiiyV^to^ 

Shepherd "et :al ','' ' "Sta^el'^ " £n : ; E^enslble ''Ele'ctrdril c' • ' 
Conversion Took kit^ ^oceVdihgfs of ' CSCW : '9b," bctdber 
25 1990) . The starudei system '"' ' 

expressions to be sent through the mail so thai: ^slxuliel is 
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very powerful. . However, because of this, Strud 1 also has 
the^ power to r cause .great, harm. . 

^ In yiewv of . ^e. fpregoing, it is an object of the 
present >\ invention to provide a general active messaging 
5 system which provides ^ active message recipients with an 
acceptable level ..of .security. v 

. ^ gummas , tfie : Tpvent ion ■» ^ | . ^ ^. 

In^ accordance with an. illustrative embodiment of the 
10 present invention, .a qomputer; system for receiving and 

processing electronic mail in the form of active messages 
comprises a central processing junit and pne or mpre 
, v^jper ipheral ^devicess . connected ^to -the .central process ing 
-unit m r.i The' : peripheral j^ey^c^s^^clude for example a file 
15 ;> v ^ recipient of. 

v .a^ac^ivje message . . ; The. p^i^heral devices also include 
/ v >^ toe computer, system 

•y'C: with , the outsid^ wpjrl display terminals, 

The computer system for .processing active messages 
includes a ; mail reader for reading electronic - mail received 
at the computer system yip a , communications channel . If 
the , jel^cteqnic ;m^il , ^contains ; pijl^ fi ^a;passiye pessage, the ;U 
.mail, reader causes the passive message to be displayed for 
the recipient/- f or >example , on the recipient 's display 
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The mail xeader may also indicate that the received 
electronic mail- comprises an active message in the ( form f 
a program which is^ made up "of one; more instructions to be 
executed by : the' cianttal ^processing unit ..t In this* ;case an 
5 interpreter is utilized to T m i 
contained in the active message so that the> instructions 
may be executed by r the-c 
' inter^et^^bc^erts : the insti^c£iohs in*:p . ma^i^e^language 
inspections for^t&is purpo the language 

10 in ; which- the - instructibhis ajr£ written , : the instructions 

ii^^ instructions by a 

compiler ratHei- th^ ah inte^reter. 
■ As indicated above i ^active v messages c pose ^a security 

'thread tb- titeik rebipxents befdnise^tli^^ 
IS o£/d^riVi^ 
" eiim^le r ; ^ 
^£ redipi^ 

sillily write a^;e^ amount of : data . into r the 

file system. Siiiil^y /-^-^efclv* -message xmay cause the 
20 d^rrv^btf^ by ^^isan^ which 

^ r t^aikea a lzb^ 
lH ' tHe "acti^'i^i^#e A^tS^^ a^acipient }bf .:anv.t: ■-■ 

input/ output ^^oiuirce :: Subft aS ar ipfriaxter 1^ <csm^ , 

25 ;^-- T To eliniirat^ 

accordance with the presVartf invention;" the interpreter can 
only interpret a limited set of instructions. If an active 
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message contains an instruction . which is not in the 
instruction set. of the Fintei^reterv, the instruction will 
not be executed: .by; the, central? process ing unit. In 
particular^ the interpreter, of. th$: present , : invent ion can 
interpret therrsubset of; a general purpose computer language 
such as LISP, i*hich subset does \hot . include instructions 
relating to the transmitting of . : da1^f t<^ o^ from the 
peripheral 'devices osuchv as ;vt^ I/Of 
devices: The interpreter of thei^ present i^iyehtipn can also 
interpret a set of- instructions, to access c ^e ^peripheral 
devidesiha manner: whichrldpes . not c^use ^-deprivation of 
resources. Thus, the interpret^ 

instructions f or accessing.^Qnly^a, pr^ete^mined- limited 
v ' ; •'- : portion of thevf ile^system ^f ,/the^irecipi 
15 fcessa^^? WitJti^ - 

v recipieht' s f ile :system, can 

' be created (isubj^tr^to: limitation^ 
* number) ; *but no files can ^be deleted or ; L overwritten. The " 
interprfettt : also ^ places limitation 
20 which can be tran3f ez^eg ; to f a : periphe^i,deyic^^l^M ^ 
c <ihstructibn :of^ an active message. ;^n.,^dditiqny there may ^ 
also be a limit pn^^ 
v ■ . f 6r vthe iais txikrtibns. ^ of ah;. actiye : ^MSsage. v -5> ..;:*;,!«-. 

When constructed ;inhth«v forego . w 
25 messaging;rsystei&~p^ 

its users so of 
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applications, while protecting recipients against serious 
resource deprivation problems. 

Brief Description of the Drawing 
5 FIG 1 schematically illustrates a ■ network ; in>i^ich 

active messages may be transmitited anbn^ u^ers./ ^ 

FIG 2 schraaticaiiy illustrates the : p^grami ^diat are 
executed ito ^ansmit^^d revive: a^^^M8&; r '-; 

£IG 3 scicdiatically illustrates Wii interpreter that may 
10 be utilized to interpret the instructions comprising active 
messages/ in accordM^ ^bodiment of 

the preslOTt/inventibn.. "/ " L " 

Detailed Descript ion of the invention : V ; ;j • 

15 *raG'a^ 

messaging ^inaa^be^ utilized 10 
CQmprxses the ma 32 ahcl; the workstations 14 

- •' " and 16; "■ ' : ' '•" -" * ."" \.i " v rV"' V Kw '. " ^.--V* ""' "v-";- : '.o 
: The main frame syst^ l^ 

20 program and data memory 22 i The memory 22 stores programs 
being «c^ni^d-b^ the^CPtr^2l r iuid : ! is- Utilised; ijri ^pimection 
with the execution [ "of -]i^^i^^ogrkms : . Tha : rairif rame ; 
computer systentrl2 liricludes ^a ziuinijcaf iof p^iph^al; devices 
v^ich eure ^ 

25 the local : .area iiefcwork c23"Si- The < p^ipher^l deyices /include ? 



^the memory "systems l ~24 ^aiid ^is'? " ^le'^mei^^^ 2$ "and 25 

are illustratively implemented by magnetic disks and their 
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associated drives. The memory systems 24 arid 25 store the 
file systems of the various users of the mainframe computer 
system 12. Also connected to the local area network 23 are 
a plurality of I/O devices such as the printer 26 and the 
5 display terminals 27 and 28. Instead of the local area 

network 23,. the, elements comprising the main frame system 
. 12 jnay-be interconnected by. a bus system or other 
interconnection medium, 

_In.additi.pn mainframe computer system 

.10 12 , the network 10 of FIG 1 includes the workstations 14 
and 16.. Each workstation, includes a CPU 31. a main 
memory 32, and a bus system 33. jCpiroected to the bus 
system 33 .are a .disk memory . 34 r a printer 35, and a display 
terminal 36. 

\.J3s^^*pt. r .j^B tJ Gmp^^^ws^esm 12 can send electronic 
>; mail ^p 7 and. v rec^iv ftlejctopnic^ttgil^ from the workstations 
; ; 14 ^Md^ie/^yia - the fl telecp^unicat ions network 40 which 
illustratively is the public switched telephone network. 
For £his purpose # ^ and the t £ 

workstations . 14 _ and 16 .include the modems 41, 42, and 43, 
respectively,; ,£pr interfacing ,with the telecommunications 
netwpr)c ; 40,. ...It is .also possible, for one user of the 
.computer ^ syst^^l2,,to send mail to another user of the -v 
computer;. syst^ l?_.via th^ lopal area network 23 or bus or . 
\--<^^:j^^!BXC€iJ^B<^iQn medium. In addition, instead of 
utilising ?ail may 
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b'e : transmitted between the' systems 12 > 14, ahd ; 16 via 
another network such' as 3Ethernet r or the- Arpa 'network. 

Consider the ! example wnere the- user -the workstation 
: 14 wishes to send 5 an electr^c 0 m^l r, 'me^ge to 3 aVrecipient 
5 who is a 'user of the coii^uter - system i2 . As ; shown in 

FIG 2, an" active or ' l passive i; message? may be-genefated at the 
workstatiiSn 14 by the user by typing oh the ••keyboard 
' : i ^assobiatea wx^^^ d^ an 
T " active mess^ag^ jm& 'be r generated automatically '.at the 
10 wbrkstdtion 14 by : an active mail generator 50; ? In any of 
%nese f cases/ the ^aes'sage^tb " ^e ^ the 
; :: eleetr«iiy maxier' ^e %ailer' 52 then transmits a piece 
of ei : ectrdrii<i m^il ^contattiittg^ ^e ? ^message Via modem 42 and 
the telecommunications netwbrk > 40 c to' the -computer^ system 
15 '' ; ''l2.'" '^a^i^'8if'^e £ ^fee1^t : ^€*c^h£c'-^^; system '--' 

M (see : David III^ ' 
internet'' ie^-'Me^age'sV^W^rk'- information Center -RFC 
#82 2 ; '' 19 82'pMarvift' ^''/Sirbu^^cbnteri^^iB- Header Field for 
' ! interact"' Messages " / N4t^6 Center M"C : #1049 , 

2b" ^1988) f ic'fcavfe AesSages 'are rf tagged ; wi^ ; an A acfeve message 5 
^ ' header v rieii.^ vri ^ '""^ ' -^ r ?'-" ^ -v< ^ 
'■■ • - £j£ : nes sage" 'aririvis' * a£ " the^computer system^ 12' via the 
" : modem iT^see^FlG^if knd^ai^memo^ under 
the control 1 6f the CPU ' 2 i' ' in ^ the ihtended 

25 ' .' recipient whxc^ r file"' sy s^em'fs T mMn€a&e'd"in : ^ 24 



or 25. 
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v 

The programs which; are executed when .the recipient at 
the computer system 12. receives his /her mail are 
....>:;U:lMs..tr3ted -i^vFig a _2 # - ^e f^gt program which is executed 
v. by, the r^cdpientj jrho. yi^es to ^eaci his/heir mail is the f . 
: mail : :reader 60 y^Lcl^ f or . ex^le,, is^ a ppxjyeiitional UNIX ^ 
mail, reader. v v :In v ^g.,inst^ce^of a passive ^message, the 
mail reader 60 {which in order ^tp be exepited.is resident 
in.the^iri iitiemqry 2J2 ,#f ^IG,.l) etch^ tlie ; recipient's^ 
messages f^om the : : 4ile system memory 2,f or 25 (see FIG 1) 
and stores : tbe. messages in ; the main memory .22 .. _ As . shown in 
FIQ 2 r ; , the message ^is ^transmitted .by . the .mail reader 60. to/ 
a display program 62^^~pte& th^, -message is. ..displaced, for 
-'??W^P^> P 1 }/^ f^ipie^ may be the 

.1 display i^rmiMl ;27; or^.28 v ., ; . ,„ >s ^ /..„ ... 

^ ^ indicated by an 

acti^% Message; h is transmitted by 

•I ^^;\®ail- r^ader^S^^ 70^ 
^?. a ^A^ e ^^^ i^te^rets .. the 

instructions cpnt^ converting 
kl the ^struqt^Lons, into^m^chine language instructipns which ^ 
are executed by the CPU 21. The active message r ^ 

; ^^^^^S^ data 5 

. an 9i ; l^sl^ctions. f or ; perf prai^g i^pu^/out^ut .operations . 
: T? pr^ a 

. ^ep^iVatioi^ of an active 

message, the active message interpreter can only execute a 
pert_ain : limited set of instructipns. Thus, the active 
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messaging system and method of the present invention work 
best when the transmitter of an active message composes the 
active message from the instruction set of the Interpreter 
70 of FIG 2* If an active message contains instructions 
5 outside the instruction set: -of tie interpreter; ~siidh 5 
instructions will not' he ikeibUted 4nd r execution of the 
active message wilf tte 'halted; - v v - , 

int^i^ret^r 70 of : FIG- "2f • may be~ described as follows. 
10 Illustratively f the instruction set of the : interpreter 70 
r :;• included the ihstriibtibh^ of ta^general purpose ^computer 

^ language- Stich as LISP.rexcept ;^pr : instructions relating to 
r ' - the/ input/output of *data Jto : an<r from various peripheral 

dfevices such- as the m^o^|.e^^> ,,25 f the printer £ 6, and 
15 the rdisplay; terminals 

the interpreter 70 also includes 7a set of . iiistructibns for 
accessing the p^iph^aL;deyic^J in a ^pirmj^S'^tch''. does not 
r lead £ the recipient to e^^ience a deprivation of computer 
i ;;*;;■■:- resources-. : : ; Thus* < the interpreter ,7b can only execute 
20 ^ instructions for ac^^skgr ^ special limited subdirectory 
of ; a. recipientfs file ^system. -7; Piles elsewhere in a-, : . 
I V recipient ' s : f ile; system^, s iip.iy do .not exist , a?VS ar as the 
interpreter 70: is cp^erne^. , fWi^ 

system that is accessible tq ; active, messages^ any files can 
25 be read. Files can also be created siibject to limitations 
on size and number. However, files cannot be deleted or 
overwritten. A further restriction ~n file names involves 
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the use of symbolic links. On certain systems such as 
UNIX, users can create symbolic links that inake files 
outside the special subdirectory for active messaging 
t .. accessible through the special subdirectory. In some 
. 5 embodiments of the invention, the interpreter restricts 
symbolic lin^ so toat : f ile namns which follow symbolic 
links beyond a single, step : cure not .interpreted. That is; a 
user can. create symbolic links, to , specific files outside 
the special active message subdirectory but . entire, 
10 directory structures -cannot be^ made so readable ? ; t . . - , 

Iri : a^ interpreter 70 

of FIG : 2 i^ i imf ttiM fro that ^ there is; a Vimi t^gn the total 

* "&ir etifeoity - ; ar£a " df a c ^dijpieinfc : amd a- r 1 iiiri t> :oh, the : number of 
15 * " bytes * that i&£ 5l ^a"%6nfc* fcio ^a^^printer-' br^ other peripheral 
device' £o p^&ce ^dii^t^^'-^ 1 ^ 1 ' c * " K} ' : t^rr; i .<:- -u 1 

A complete ihst^c^bii ifet: tor 1 ^ 3 active • Messaging 
Jjitei^rettt pu±poae ! and widely 

" '' av^ilablW Iknguagii ^wn" ra^fcfr'SP .' ' ? ln p^ar^railar f ; .to. arrive 
2o set||of 
I^SP';- - ; &e"i^ • 

infrnt/but^t 

resourced ^4 3 ¥l^^ u in6ifid^d:* 7 ' ^ — ' * <*• - . ^.^ - ,/-.• " 
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it is a significant advantage of the active messaging 
system and method of the' present inWritibri that the 
ins^ctibn se^ of 

instruction set of a general 1 purpose 'computer language such 
5 as LISP . J This makes the active : messaging system highly 
portable over a r Vide ; varied bf : user interface platforms, 
operating' systems? : fed^€rbhv^^ 
•- <^^*| s : ^ l^^^harfc ^ieh -4c^^ . " 

the operation' of : the interpreter TO of FIG 2. ' Each 
10 instruction" of ah" active message tb be ^executed is fetched 
' :/ " from" a 'main membr^ ; (eVg\"22i assbciated with-the CPU (e.g. 

which executes l^^instxuctibh'"- (step 100 of FIG 3) . 
v in^icaled fplrevibu^iy; ' the inst^c^iohs comprising an 

' -iac^ive' message; are' : - ^ 
15 itoinv;memor^-'io be" executed)'.. '^'A test ^s :> then; ii^de to 

determine if the fetched -instruction 5 i? safe (step 110 of 
FIG' 3) . This L test' is implemented by; determining if the 
'retched' jjistrfiction is in the i^sl^ction set of the . 
interpreted. ; : -if ffie i^^ctiton is not -in the instruction 
20 X? - set, execution: is ^na^bd fs^ep £26) i ,. If the, anstracti.on 

' is^in^the^insi^^ 
■ (-step-tiib) ."" "z,-;- : ; •; ' ' • '. 

c-;; • . ^ The step 110 \rmay vbe > 
"' lookup, i.e. , to "carry' l^o|, for; r each 
25 instruction in an ac^iv^%e%sa J geV'"jai table -lookup "is 

perf ormed to see ? ■&tite- r la£^^€ii is in -the interpreter's 
instruction set. Note ; th'a£ an ins truction ^ay toe outside 
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: the instruction set because an operator is excluded or 
because an operand is, excluded such as in the case of an 
instruction . which .trip^ a predetermined 

. , number of kbytes ^^ijite^ .. ^ , 
5 r i,The execution : st^p ,130 usually inyplyes converting the 

active .message ipstOTcrtions^to^ machine language 
instructions; which are then executed by the CPU (e.g. 21) . 
: : In : the case whei^e tJtie ;i|^$pirtipn . s;et .. is^ deriyed from the; 
LISP language ,>; ; the, • ^ecu^pn. -step,. 13.0- -say .-be implemented 
1Q through : use qf, a LISP^ engine^ for excu^ ELI (Embedded 
IiISP. Interpreter) , which is r available for example from IBM. 

Ir** * - 

I •.■■".After an ; Instruction^ 130), a,test.is 

I performed to .determine if .there are any r instructions 

^ remaini^ -in;^e if so f control is 

returned., to^ the step, 100 and the next instruction is 
fetched from the jmain^emqi^.^ ^ :: , , . 

In; some embodiment s^bf i the invention, it may be 
desirable-, to ; ; giye ■ ? a xecipi^nt ... of % a message more control 
oyer whether or not; spejrtain instructions are or sure not ^ 
executed, <i.e 0 -fpr .soms ; instructions the recipient may be^ 
asked to j state whether^r not .the . instruction should be 
executed. ; The portion, of the flowchart relating to this 
; feature is .designated >y 200 in FIG 3 - ^ . 

v ' ' -V ••■it* .Cr.tr. - r.r - '^7 ... „ o>.;^>\ £ . ■ ' " 

In; this case, ,aix- instjruction which is nqt indicated as* 
25 safety ■ ihg step 110/ ris siibjected to a test (step 210) to 
^- determine ]if ^ ^the ins^t^cti^ This 
test jnay^b^ i jApJLj^je^b|^ ^of a second ta^ble 
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lookup which contains a list of the potentially, safe 
instructions. A potentially, .safe destruction K is an 
instruction which may^e; safe or; unsafe; ^pending ; pn the 
specific operators and operands and» depending PP } the 
S specif ic circumstances of the message^ recipient,. If an 
r instruction fails the test! 110 and- the: test/210 ?f . execution 
' is terminated- (step- 120) . If ah; instruction fails. the test 

-iio but thV ^ 
potentially safei the recipient is, asked if he/she wants 
'■ io 1 the instruction executed (step 220) . If the recipient . 

desires the 1 instruction toi bet executed, - then; control passes 
to'step 130v -1^ 

instruction executed, control p^ses, to ; v the ;: st^p? 120 . 

An example of an instruction - which is potentially safe 

15 is ah instruction "for sending'mail. Therefore, in 
accordance with an illustrative y embod^ 
invention, whenever an 'Irtive'-'iieatfage-'runniii? in. a 
recipient' s computer environment tries to ;send mail; the 
recipient is told of this attempt arid given an opportunity 

20 to inspect the mail and decide whether the mail should be 

sent. Without this restriction* i* wo^^ create 
viruses/ chain letters and other undesirable phenomena 
using active messaging. ; . . 

r in addition to toe -f orego^ 

25 "by meahs of an interpreter, a limitation may be placed oh 
^ the amount of time which ciri be taken 5 by an active 
message. While in some embodiments 
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limitation can be incorporated in the interpreter, when the 
UNIX bpe'ratlhg" ? syst^j-*is^ufcili-2ed>* : it may be easier to 
impli^e^ through use of operating 

-system *f aci^t^s&v. ^.v^-./ : -^y,-;^,, ... ^ . 

5 In 1 short; * a^ method and sy^em; for, carrying out active tr 

messaging is disclosed, i The ; system; and method .enable a 
recipXent^ to ; enjoy' the many belief its, pf active messaging^; 
while r^ubirttf^e of ^ctiv^e ^ss^ging . %$.. 

Finally-,- fchef abbve?-described embodiments of;; the inventions 
10 ; are "intended- to b4 illustrative^ ronly. Numerous alternative 
embodiment^ 

withbiit departing^ f*on£ tlAe^sp^it ; vand rscope^ of, the. 
-i fbllowing;: claims^ %-^?/-^ 
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\ A compter ^sten i=r teceivih, ina procssin, 

information containing an active 

action, « be executed; said computer system 

~ ^"tcLaX process^ unU ana one ~ more PC^ra! 
.ovices co^ectea to said ^entrai.prccessin, .unit, 

^' »e,ns forreceiving said Information via a 

-. said computer system, and 
, communications channel at said ^^ion 
' ; =-«jtfaiSj-» for determining 1* each 

" i^tructions. f or converting the instruct!^ ^ 
active message belonging to said set into a f 

, .UUrral processing ul.it, and for 

5 " for execution by said central pr 

5 • J ..■ . - - i,„„ „f M id instructions m said 

inhibiting the execution of saw 

' active message not belonging to said set. ^ 
Mid predetermined set of instructions comprising a 

\, A ' • *\ ourpose computer language but 

- instruction set of a ^ _ o£ flata co 

; excluding potions relat»,« th ; 
' ' or from said one or more peripheral de« ^ 

predetermined limits. .. 
■ ' % ■ We' computer system of claim 1 Wherein said 
converting means comprises interpreter. 
25 - ^"3. The computer sVstem of ciai^ ' 
reverting means ^ cpmpris«a compiler.^ 
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4. The system of. claim 1 wherein one of said 
peripheral devices is a file system memory connected to 
said .centeal^ ^|>rp^essin^ unit for storing, a file system of a 
recipient of said actiye message, and wherein said 
5 predetermined . : li^it:s def ine a predetermined portion of said 
file system of said recipient, so that said predetermined 
r instruction ~set ^includes instructions for accessing said 
predetermined, file portion of said recipient and excludes 
. instructions for -accessing the remainder to the file system 
10 of said recipient. ..... . 

5i. ^The system claim 4 wherein said predetermined 
set of ? instru^ for reading any 

: file : in /y said file system of 

said recipient, instructions for creating new files of a* 

:"' ■: r-rv V o5 ■r./ix^ i-iia jt:.- 7. " ::.-v' : " .; ; 

predetermined size and number in said predetermined portion 
" :' " ^ ' ' ' v " :: '''' " : r '' T " ~ ^ ■ ^&?rSAil-*. ^ Si? ■ . vrf . n A - , . 

. of said fii,e^ system r of said recipient, but excludes 

instructions, r f or deleting files or overwriting existing 

f iles. (V ,.._ t ^ . 

.■- ;V;r ^, t; 6. .The system of claim 5 wherein said predetermined 

. .lipits : ^ ; includ^ a limit on the number of bytes which may be 

written .into ; said predetermined portion of said file system 

of .said recipient. 
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;7. The system of claim 1 wherein said system includes 
means for limit ^ of the instructions 

25 container!, ^in said, .active message to a predetermined amount 
of central processing time. 
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8. The system of claim 1 wherein said predetermined 
set of instructions include an instruction ior sending 
electronic mail. 

9. The system of claim 8 wherein iiistructibhs for 
5 sending electronic mail is an instruction for striding 

electronic mail cpntaining an active -message. 
■ s, io/^e system of claim 4 wherein' said ~ predetermined 
set of instructions; liiciude an ihstru^i^"^^ 
said file system of said recipient containing a bne-step 

10 syn^lic link? 

11. A computer system for receiving .and processing 
information containing an active Message made up 6i 
instructions to be .executed-; said ' r a^iii^'-'W^tem : ---- 

r f v - comprising^ : c .„ _ . \ ^ ' ' . t 

15 > a; cj^tral processing ^ unit and brie or idbre peripheral 

devices cpimefcted to said' central processing unit , 
means for receiving said ihformatxori ^ia a 
communications .chaijnel at said computer system/ and 

, ^) instruction 
20 : ^Ln belongs to a predetermined £e»t of 

, , in said 

. ; active message , belong^g .to said set into a iora s^table 
for execution, by sai4 central processing unit I and for 
inMbit irig the execution of said instruct ions in siid 
25 active message riot belonging to said set. 
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. said predetermined set of instructions comprising an 
instruction set of general purpose computer language* but 
excluding instructions relating to = the transfer of data to 
or from said peripheral devices beyond predetermined 

5 limits, .... , 

12. The system of claim 11 wherein said interpreter 
includes means for enabling a recipient' of ah active" 

message to control whether selected ijfis&ctions contained. 

; *'' ' ■ '• • r'.nrhx/y-fc: f s it..-,.:. ; * .?>-,<•. ^s>jis^-.: •.<<••' V 
in the. active message are executed. 

10 - 13 . A method for processing information containing an 

active, message made up of instructions to be executed 
comprising .the step S of ^ 

receiving said active* message at: a computer system 
via a communications channel, 
15 ; translating said instructions in said active message 

which belong to a predetermined 'set' of instructions into a 
form suitable for execution by a central processing unit 
forming part of said computer system,' and 

inhibiting the execution of ^ ' instru(^ibris co^ 
20 in said active message not belonging t<5 said 'set, ' 1 
said predetermined set of instructions comprising an 
. instruction set of a 'general ^purpose ^ dompiiter 0 language but 
excluding instructions relating "to J t&Vtransf er - ; oi l dat| t<? 
: or from one more peripheral devices connected to said 
25 central processing unit beyond predetermined limits' 
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14. The method of claim 13 wherein said method includes 
the step of utilizing a table lookup tb determine; if an 
instruction in said active message belongs to said 
predetermined set of instructions . f i \\ 
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